runtime: ride out venue outages against a grace watch deadline

[mfw78]

What

Refactor the venue status-watch eviction so a watch's give-up deadline refreshes only when the venue is reachable (a status() poll returned Ok, even if the body then failed to encode). A resolve() failure or an errored poll rides out against a grace window instead of burning the deadline. grace = min(2 * expiry, 24h), overridable via [limits.watch] grace_secs.

Closes #511. Also folds in the encode-failure refresh path flagged in review of #438 (the PR that added this watch machinery); no standalone issue was filed for that finding.

Stacked on #445 — its Liveness / resolve-failure machinery is what makes the resolve-fail path reachable, and the new test drives it via Liveness::mark_dead().

Why

Two paths bypassed the sole expires_at refresh, so a venue that stayed unreachable longer than the window silently lost a pending intent's watch:

• Resolve failure / errored poll (videre-host: a venue outage past the watch-expiry window silently evicts pending intent watches #511): once venue adapters joined the poison/restart sweep (runtime: fold venue adapters into the restart and poison sweeps #445), a resolve() failure (adapter poisoned or mid-restart) skips record_polled_status, and an errored poll (a CoW-API outage) never refreshed either. A pending order could fill while the host had stopped watching it, so the module never received the IntentStatusUpdate.
• Encode failure (flagged in runtime: bound the status-watch set with a capped, expiring policy #438's review): an encode failure return Noned before the refresh, penalising an alive venue for a host-side encoder bug. Defensive today, since status_body cannot produce an unencodable body, but load-bearing if proof / reason ever carry venue data.

The fix treats "the venue answered" as the single refresh condition, and makes eviction during an outage an explicit, bounded, configurable grace rather than a silent surprise. resolve()-fail and errored-poll behave identically (both ride out), so no per-outcome pause or absolute-age machinery is needed.

Testing

• cargo test -p nexum-runtime — 71 host/config tests green.
• New: grace_derives_from_expiry_and_caps_at_a_day, a_dead_venue_rides_out_without_refreshing_the_deadline, an_errored_poll_rides_out_without_refreshing_the_deadline, plus grace_secs coverage in watch_limits_parse_with_overrides.
• cargo fmt --check and cargo clippy --all-targets --all-features -- -D warnings clean on 1.94.

AI Assistance

Design and implementation assisted by Claude.